Adobe shipped the patch on June 30, 2026. Two days later, before most patch cycles had even started, someone was already knocking on the door — writing files through the exact code path Adobe had just fixed. That’s the story of CVE-2026-48282: not a slow-burn campaign, but a vulnerability that went from “patched” to “actively probed in the wild” faster than most change-management processes can schedule a maintenance window.

TL;DR

  • CVE-2026-48282 is a CVSS 10.0 path traversal (CWE-22) in Adobe ColdFusion’s Remote Development Services (RDS) FILEIO handler, letting an unauthenticated attacker write arbitrary files — including a .cfm webshell — anywhere on disk, including the web root.
  • It’s one of 11 CVEs Adobe patched in bulletin APSB26-68 (June 30, 2026), six of them rated a full 10.0. A separate, unrelated CVE (CVE-2026-48286, incorrect authorization) hit Adobe Campaign Classic the same day — different product, different bug class, don’t conflate the two.
  • KEVIntel’s honeypot network detected exploitation attempts within about two hours of public technical detail becoming available, per researcher Ryan Dewhurst — publicly documented activity so far is a small number of probing attempts from a single IP geolocated to India, not a confirmed mass-compromise event.
  • CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on July 7, giving US federal civilian agencies until July 10 to remediate it. The listing confirms exploitation, not the number of compromised organizations.
  • Exploitation requires RDS enabled with authentication disabled — not the default configuration, but a setting with a long history of being left on in legacy deployments. Shadowserver counted roughly 750-800 internet-facing ColdFusion instances during this window.
  • Fixed in ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21. Adobe rated this Priority 1 and recommended patching within 72 hours.

Why This Matters to You

If you run ColdFusion anywhere in your environment — and a surprising number of organizations still do, often on systems nobody has actively developed against in years — this is the kind of bug that turns a forgotten legacy app server into a beachhead. The exploit needs a single unauthenticated HTTP request. No credentials, no social engineering, no user interaction. And the timeline here is the real headline: public technical detail to in-the-wild probing in about two hours means your patch window isn’t measured in “this sprint” anymore, it’s measured in “before lunch.”

Table of Contents

What CVE-2026-48282 Actually Is

CVE-2026-48282 is a path traversal vulnerability (CWE-22) in Adobe ColdFusion, scored CVSS 3.1: 10.0 — Critical. Adobe’s advisory describes it as allowing an unauthenticated attacker to write arbitrary files to the file system, up to and including remote code execution. It affects ColdFusion 2025 Update 9 and earlier, and ColdFusion 2023 Update 20 and earlier (and presumably prior release lines still in support).

The vulnerable component is Remote Development Services (RDS) — an older HTTP-based RPC interface ColdFusion exposes so an IDE can browse the file system, run database queries, and assist with remote debugging, all without a full development environment on the target box. RDS is not enabled by default, and when it is enabled it normally requires its own separate authentication — but plenty of long-lived ColdFusion deployments have RDS turned on with authentication disabled, either from legacy configuration inherited across upgrades or because “it’s an internal box” assumptions eroded once the server ended up reachable from the internet.

Adobe fixed the issue in ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21, released alongside the rest of the June 2026 security bulletin.

The Technical Root Cause

The bug lives in RDS’s FILEIO handler, reachable at /CFIDE/main/ide.cfm?ACTION=FILEIO, which processes file operations — READ, WRITE, RENAME, REMOVE, CREATE — sent as a length-prefixed RPC payload over HTTP POST. Per the technical writeup published by watchtowr Labs, the handling code took a user-supplied filename and passed it straight to a file-system API call without canonicalizing the path or checking it against an allowed-directory boundary. A payload containing ../ traversal sequences, or an absolute path outright, walked the file operation clean out of whatever directory RDS was supposed to be scoped to.

The patched code routes the same input through path canonicalization and boundary enforcement before any file-system call executes — resolving the path, rejecting null bytes and .. sequences, and confirming the result stays inside the approved RDS directory. That check simply wasn’t there before.

Because the FILEIO handler supports a WRITE operation, the practical impact isn’t “read some files you shouldn’t” — it’s “write any file you want, anywhere the ColdFusion service account can write.” That includes the web root.

From Advisory to Webshell: The Attack Chain

Researchers who reverse-engineered the patch diff (most visibly watchtowr Labs) published a working proof of concept showing the full path from bug to shell:

1. Confirm RDS is reachable and unauthenticated — request
   /CFIDE/main/ide.cfm?ACTION=FILEIO on the target host
2. Send a crafted WRITE operation whose target path traverses
   out of the RDS working directory and into the web root
   (e.g. cfusion/wwwroot/), carrying CFML webshell content
3. Request the newly written .cfm file directly over HTTP —
   ColdFusion executes it like any other page on the site
4. Use <cfexecute> or equivalent CFML tags inside the webshell
   to run OS commands with the privileges of the ColdFusion
   service account

No authentication, no chained bug, no user interaction — a single crafted HTTP request against an exposed, misconfigured RDS endpoint is sufficient to go from “path traversal” to “code execution in the current user’s context,” as Belgium’s Centre for Cybersecurity separately confirmed in its own advisory on the flaw.

Exploitation Timeline and What We Actually Know

This is where reporting needs care, because headlines and reality diverge slightly.

Confirmed: Adobe published APSB26-68 and shipped patches on June 30, 2026. watchtowr Labs published a detailed technical breakdown of the patch diff shortly after (within days). KEVIntel, a threat-intelligence honeypot service run by researcher Ryan Dewhurst, detected exploitation attempts against its global sensor network within roughly two hours of that technical detail going public — Dewhurst’s own words were that KEVIntel “captured in-the-wild exploitation” that fast. Multiple outlets (BleepingComputer, SecurityWeek, Help Net Security, Security Affairs) independently reported this same detection.

What’s thinner than the headlines suggest: the publicly documented exploitation activity, as of this writing, consists of a small number of attempts — reporting specifically cites two exploitation attempts, on July 2 and July 3, both traced to a single IP address geolocated to India. That’s a meaningful signal that automated scanning-and-weaponization pipelines picked this bug up almost instantly — it is not, at least in what’s been published so far, evidence of widespread active compromise across many organizations. Shadowserver’s scan data puts the internet-facing attack surface at roughly 750-800 exposed ColdFusion instances during this window, which is the number that matters for risk sizing: a small confirmed exploitation count against a modest but real exposed population, with a bug that’s trivial to weaponize once you know the RPC format.

CISA confirmed the exploitation signal: on July 7, 2026, CISA added CVE-2026-48282 to its Known Exploited Vulnerabilities catalog and set a July 10 remediation deadline for US federal civilian agencies. A KEV listing means CISA accepts that the vulnerability has been exploited in the wild; it does not establish mass exploitation or reveal how many production systems were compromised. Adobe’s Priority 1 rating, the KEV entry, and your own exposure are separate but mutually reinforcing reasons to treat the update as urgent.

We also found no public reporting tying CVE-2026-48282 specifically to ransomware staging or confirmed data theft — that link exists for ColdFusion’s broader CVE history (CISA’s 2023 advisory on a different set of ColdFusion CVEs explicitly ties prior flaws to ransomware intrusions), but not, so far, to this specific vulnerability. Given how young the exploitation activity is and how straightforward the webshell path is, that’s a gap likely to close, not a durable conclusion — this section reflects what’s public as of publication, and the honest answer is “too early to say” rather than “confirmed absent.”

Don’t Conflate This With Campaign Classic

The same Adobe patch cycle also fixed a critical, unrelated bug in a different product: CVE-2026-48286, an incorrect-authorization flaw in Adobe Campaign Classic (CVSS 10.0), which could let an attacker execute arbitrary code on on-premise Campaign Classic deployments (ACC v7: 7.4.3 build 9396 and earlier). Adobe-hosted Campaign instances were already updated and required no customer action; on-premise and hybrid deployments needed the patch to 7.4.3 build 9397.

These are two separate CVEs, two separate products, two separate bug classes (path traversal vs. incorrect authorization), announced in the same news cycle because Adobe happened to release both fixes around the same date. If you’re tracking remediation, don’t merge them into one ticket — the affected software, the exploitation path, and (as far as public reporting shows) the exploitation status are all different. CVE-2026-48282 is the one with confirmed in-the-wild probing; CVE-2026-48286 does not have public reporting of active exploitation at time of writing.

ColdFusion’s Long, Rough History

CVE-2026-48282 isn’t an outlier for the product — it’s a continuation of a pattern. ColdFusion has repeatedly produced critical, pre-authentication vulnerabilities that ended up actively exploited:

  • CVE-2023-26360 and related 2023 CVEs (deserialization and path traversal, CVSS up to 9.8) were the subject of a CISA advisory in late 2023 confirming active exploitation against public-facing ColdFusion servers for initial access.
  • CVE-2024-53961 — a path traversal allowing arbitrary file read, with public proof-of-concept code.
  • CVE-2025-54261 — a path traversal leading to arbitrary file-system write, CVSS 9.0, across ColdFusion 2021/2023/2025.
  • Now CVE-2026-48282, path traversal to arbitrary file write to unauthenticated RCE, CVSS 10.0.

Path traversal specifically is a recurring bug class here, not a one-off — several of the RDS-adjacent operations covered in APSB26-68 alone (read, write, delete, directory listing) trace back to the same class of missing canonicalization. If your organization still runs ColdFusion, the operating assumption should be that another critical file-system-boundary bug is a matter of when, not if.

Detection: What to Hunt For

If any ColdFusion instance in your environment was internet-facing in the days around late June/early July 2026, treat it as potentially compromised until proven otherwise:

  • Unauthorized files in the web root and /CFIDE/ directories — especially .cfm files with recent creation timestamps that don’t match a deployment or release.
  • Outbound requests to newly-created .cfm pages in web server access logs, particularly ones never referenced by legitimate application navigation.
  • POST requests to /CFIDE/main/ide.cfm?ACTION=FILEIO in access logs — this endpoint has no legitimate reason to see traffic on a production server where RDS should be disabled.
  • <cfexecute> invocations or unexpected child processes spawned by the ColdFusion service account (cfusion process tree spawning cmd.exe, powershell.exe, /bin/sh, etc.) — a strong signal of a live webshell being used interactively.
  • RDS configuration state — confirm whether RDS is enabled at all, and if so, whether it enforces its own authentication. Many admins don’t know this setting exists separately from the main ColdFusion administrator login.

MITRE ATT&CK Mapping

TacticTechniqueID
Initial AccessExploit Public-Facing ApplicationT1190
PersistenceServer Software Component: Web ShellT1505.003
ExecutionCommand and Scripting InterpreterT1059
StealthMasqueradingT1036
DiscoveryFile and Directory DiscoveryT1083
CollectionData from Local SystemT1005

What You Can Do Today

  1. Patch immediately. Upgrade to ColdFusion 2025 Update 10 or ColdFusion 2023 Update 21. Adobe rated this Priority 1 and recommended remediation within 72 hours — given the documented two-hour exploitation onset after public technical detail, treat that window as generous, not conservative.
  2. Disable RDS if you don’t actively need it. Most production deployments have no operational reason to run Remote Development Services at all. If it’s on “because it’s always been on,” that’s the finding, not a justification.
  3. If RDS must stay enabled, enforce its own authentication. RDS auth is configured separately from the ColdFusion Administrator login — verify it explicitly rather than assuming the main admin password covers it.
  4. Hunt for indicators of compromise now, regardless of patch status. Check web root and /CFIDE/ for unexpected .cfm files, review access logs for ACTION=FILEIO requests, and look for anomalous process spawning under the ColdFusion service account — assume exposure occurred before you patched, not after.
  5. Inventory every ColdFusion instance you actually have. Legacy application servers running old ColdFusion versions are exactly the kind of asset that falls off patch-management radar because “nobody develops on it anymore” — that doesn’t mean it isn’t internet-facing.
  6. Segment ColdFusion servers from sensitive internal networks. A webshell dropped via this bug runs with the service account’s privileges — limiting what that account can reach limits blast radius even if initial compromise succeeds.
  7. Treat the KEV deadline as confirmation, not a safe patch window. CISA added the flaw on July 7 with a July 10 federal deadline, but exploitation attempts had already been observed. Exposed or RDS-enabled systems need immediate remediation and compromise hunting regardless of whether the federal deadline applies to your organization.

Sources